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METHOD, COMPUTER-READABLE MEDIUM, AND NODE FOR DETECTING 
EXPLOITS BASED ON AN INBOUND SIGNATURE OF THE EXPLOIT AND AN 
OUTBOUND SIGNATURE IN RESPONSE THERETO 


ABSTRACT OF THE INVENTION 

A method of detecting an intrusion at a node of a network comprising reading a 
first packet received by the node, determining a first signature of die first packet, 
comparing tiie first signature witii a signature file comprising a first machine-readable 
5 logic representative of a first packet signature, determining the first signature corresponds 
with the first machine readable logic, reading a second packet generated by the node in 
response to reception of the first packet, determining a second signature of the second 
p packet, comparing the second signature with the signature file further comprising a 

second machine-readable logic representative of second packet signature, and 
!aI 10 determining the second signature corresponds with the second machine readable logic is 
1^ provided. A computer-readable medium and a node for detecting an exploit based upon 
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an outbound signature generated in response to an inbound signature of the exploit are 


13 also provided* 
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